Proxies for Chewy: Three Bot Walls and a Subscription Price

Proxies for Chewy have to clear an unusually crowded door. Most retailers run one bot-defense vendor; Chewy runs three. On 24 August 2026 we pulled the Chewy homepage and read its own embedded configuration, which carried fields named akamaiBotSbsd, kasadaRequestId, kasadaClientId and kasadaClassification, and the page itself was dense with F5 Shape telemetry. That is Akamai, Kasada and Shape wired into the same page, each watching for something the others do not. For a scraper, it means there is no single wall to study; there are three, in series, and a client has to pass all of them.

Chewy is worth that effort because its prices are subscription prices. The pet-supply market runs on Autoship, Chewy's recurring-order program, and the discounted subscribed price is the number most customers actually pay, which makes "the Chewy price" a two-valued thing. Chewy is also newly international: it launched in Canada in 2023, its first market outside the United States (GlobalPETS, Chewy's first international expansion).

What proxies work best for Chewy?

US rotating residential proxies behind a real browser, one exit per session, because all three defense layers reward consistency and punish a bare client. A static ISP proxy for a logged-in account with saved pets and an Autoship plan. Datacenter proxies fail on at least one of the three layers on contact.

Three systems, three different checks

The value of naming the stack is that each layer fails a different mistake, so knowing which one you tripped tells you what to fix.

• Akamai reads the TLS handshake and runs a sensor script that sets a cookie only after its data validates. A bare HTTP client with a browser user-agent is caught here first, on the JA3/JA4 fingerprint, before the sensor even matters (how the _abck cookie works, what is JA3/JA4 fingerprinting).
• Kasada issues a JavaScript proof-of-work challenge: the client has to run Kasada's obfuscated script and return a computed answer before it is trusted. A client that cannot execute that script never gets a valid token (how to get past Kasada).
• F5 Shape scores the session's behavior over time, mouse movement, timing, whether the telemetry-reporting JavaScript actually runs, and blocks once the pattern looks automated (how to handle F5 Shape).

The combined effect is that the two things a scraper usually leans on, rotation and a solver, are each only a partial answer here. Rotation does not help against Shape, which scores behavior; a solver for one vendor does nothing about the other two. The only client that clears all three is a real browser behaving like a person on a consistent connection, which is precisely what a clean residential exit plus Playwright provides.

Autoship makes the price a subscription

Chewy's pricing has two layers, and Autoship is the reason. A first Autoship order takes 35 percent off, capped at a $20 discount, and every recurring order afterwards saves an additional 5 percent on eligible items (Slickdeals, Chewy 35 percent off first Autoship). Free shipping kicks in over a threshold. So for any product there is a one-time price and an Autoship price, and they differ by a meaningful margin.

A price-intelligence project has to record which one it captured. A competitor benchmarking against Chewy on one-time prices is comparing against a number few Chewy customers pay; benchmarking against the Autoship price means reading the page in a state that shows it, which usually means a logged-in or subscription-selected view. This is the detail that separates a useful Chewy dataset from a misleading one, and it is invisible if you only scrape the default price.

Which proxy type fits which Chewy job

Rotating residential IPs are real home connections, the clean reputation all three layers start from. ISP proxies never change, which the account and subscription views need. Mobile proxies are the last resort for sessions that keep tripping Shape or Kasada. The residential kinds are compared in rotating vs static residential proxies.

Setup

Use a real browser and do not fight it. Against a stack that includes Kasada's proof-of-work and Shape's behavioral scoring, the browser is not optional and a headless setup has to look genuinely human: real timing, real movement, the telemetry JavaScript actually executing (proxies for Playwright, proxies for Puppeteer).

Hold one exit per session. All three layers tie their trust to a consistent connection, so pick a residential exit and keep it for the whole session; rotating mid-session resets Kasada's token context and Shape's score at once. The window mechanics are in sticky vs rotating proxy sessions.

Decide which price you want before you build the reader. One-time prices come from the default view; Autoship prices come from a subscription-selected or logged-in view, which is an account job on a static ISP address. Label every captured price with its state.

Read Canada from Canada. chewy.com/ca is a separate storefront; a US exit gives you US prices no matter what the URL says.

Sizing

Because the browser is mandatory and every session is scored, throughput comes from many concurrent shopper-paced sessions on many exits, not from one fast session. Decide how many pages one session can read before Shape's score tips, and scale sessions to hit your volume. Budget browser-level bandwidth, well above bare HTML, from headless browser proxy bandwidth cost. Accounts are one static ISP address each. Our pricing is pay-as-you-go with a balance that never expires.

Free versus paid for Chewy

A free proxy is a shared datacenter address with no browser, and Chewy's stack has three separate ways to reject exactly that client. Free proxies confirm your pipeline forwards traffic and an address is alive, which our free proxy list and proxy checker cover, and nothing more. Reading Chewy at any scale needs paid residential, from $0.44/GB pay-as-you-go with no KYC, behind a real browser. The boundary is in datacenter vs residential proxies.

Staying unblocked

• Do not rotate mid-session. It resets Kasada's token and Shape's score in one move.
• Make the browser genuinely human. Kasada and Shape are both watching execution and behavior, not just headers.
• Do not treat a clean first page as safe. Shape scores over the session; keep the pace human throughout.
• Separate the two prices in data. A one-time price labeled as the real price is a wrong number.
• Log which layer turns you away. A 403 with a sensor failure is Akamai; a proof-of-work failure is Kasada; a mid-session block is Shape. Each points at a different fix. The wider list is in avoiding IP bans while scraping.

What a proxy does not do here

A proxy gives a browser session a clean, consistent residential address and keeps accounts apart. It does not run Akamai's sensor, does not compute Kasada's proof-of-work, does not make a headless client behave like a person for Shape, and does not turn a one-time price into the Autoship price. Scraping Chewy runs against its terms of use, a risk that stays with you whatever the addresses are.

What a residential exit does is put a well-built, human-behaving browser session on trusted ground so it can clear all three gates in a row, which is the only way through a stack like this. Prove the plumbing with the free proxy list, then read with residential from $0.44/GB, one exit per session, and record both the shelf price and the Autoship price.

Sources

• GlobalPETS, Chewy announces first international expansion to Canada: the 2023 Canada launch.
• Slickdeals, Chewy 35 percent off your first Autoship order, maximum $20 off: the first-order discount and cap, and the ongoing 5 percent.
• Kasada, bot defense platform: the proof-of-work layer named in Chewy's page config.
• F5, Shape / Distributed Cloud Bot Defense: the behavioral layer instrumenting the page.
• HProxy test on 24 August 2026: the Chewy homepage carried configuration fields akamaiBotSbsd, kasadaRequestId, kasadaClientId, kasadaClassification and heavy F5 Shape telemetry, evidence of all three defenses running together.